CMDash product datasheet
Compliance tracking, risk quantification, third-party risk, and security-program management in one platform, delivered as a managed SaaS.
At a glance
Seeded as real controls, plus unlimited custom frameworks via CSV import.
Counted from the same seed files the product runs on.
Verbatim, source-cited requirement text — not a paraphrase.
Adapters that exist on disk today, each with contract tests.
Control-to-control mappings, so one piece of evidence satisfies several frameworks.
Compliance management
Authoritative control text drawn verbatim from NIST, the eCFR and EUR-Lex, with a crosswalk engine that carries a control’s status across frameworks, and its evidence too when you switch that on. Policy library, evidence collection with continuous control monitoring rules you install or write, and per-framework assessment workspaces — including an official CMMC Level 2 self-assessment package for C3PAO submission.
Risk & posture
Weighted, configurable posture scoring across signal families. FAIR quantification with Monte Carlo loss-exposure modelling, expressed in currency. Full-lifecycle risk register, predictive risk forecasting, and board-ready executive reporting including a cyber-insurance readiness pack.
Third-party risk management
Vendor inventory and risk rollup, security questionnaire templates, SBOM ingestion with KEV enrichment, vendor rating monitoring with your own SecurityScorecard or Bitsight key, and concentration-risk analysis. Questionnaires reach vendors by e-mail.
External exposure & reputation
Continuous DNS and e-mail authentication checks (SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI, DNSSEC, CAA, dangling-CNAME takeover) on the domains you have proven you own. IP blocklist and reputation tracking for the addresses your domains publish plus any you declare. An explainable outside-in reputation score built from your own DNS, TLS, IP and exposure findings, shown beside your existing SecurityScorecard or Bitsight rating if configured, plus lookalike-domain and certificate-transparency monitoring for your verified domains (Essentials+).
Security program management
Multi-model maturity scoring (CSF tiers, CIS Implementation Groups, C2M2, CISA ZTMM) with current-versus-target profiles. Control-efficacy validation that distinguishes tested from merely attested. Program office with initiatives, security budget planning, and what-if scenario analysis.
Platform & administration
SAML SSO, SCIM v2 provisioning, LDAP sync, and TOTP MFA. vCISO and MSP operators manage multiple client organizations from one account, isolated from each other the same way every tenant is: row-level security forced at the database, not application-level filtering. Four published tiers and enterprise contract billing; a plan is bought through a quote, and online card payment Coming soon
Deployment & operations
Managed SaaS, hosted and operated by CMDash on AWS in us-east-1. A self-hosted install on your own servers or in your own AWS account, for the Enterprise plan, runs on a signed license file that is checked offline. Coming soon A signed offline installation bundle and a fully air-gapped install are not offered.
Technical profile
apps/api/prisma/schema.prisma + apps/control-plane/prisma/schema.prisma.
apps/api/src, one row per @Controller().
Repo-wide *.test.ts(x) and *.spec.ts, excluding node_modules. Published as a floor — the exact count changes with every fix.
Backend: NestJS · TypeScript · Prisma. Frontend: Next.js · React. Data: PostgreSQL with row-level security, Redis, S3-compatible object storage.
Editions
| Capability | Starter | Essentials | Command | Enterprise |
|---|---|---|---|---|
| Compliance frameworks | Limited | Limited | ✓ | ✓ |
| Risk register & posture scoring | ✓ | ✓ | ✓ | ✓ |
| Crosswalk engine | Limited | Limited | ✓ | ✓ |
| Evidence packages | — | — | ✓ | ✓ |
| FAIR quantification | ✓ | ✓ | ✓ | ✓ |
| Third-party risk management | — | — | — | ✓ |
| External exposure & reputation | — | ✓ | ✓ | ✓ |
| Trust Center | — | — | ✓ | ✓ |
| Board decks & executive briefings | — | Limited | ✓ | ✓ |
| Public API & webhooks | Limited | Limited | Limited | ✓ |
| SAML SSO | ✓ | ✓ | ✓ | ✓ |
| SCIM · LDAP directory sync | — | — | — | ✓ |
| Multi-business-unit | — | — | — | ✓ |
| Enterprise contract billing | — | — | — | ✓ |
“Limited” means a narrower, real capability at that tier (a capped or read-only form), not a marketing hedge — for example, Starter and Essentials can read a crosswalk but not run the full engine, and Command has read-only API access rather than webhooks and writes. See /pricing for current plan details and add-on SKUs, including third-party risk management sold to Command as a separate line item.
See it against your own controls
Start a 30-day free trial of any paid plan.
A card is required; the trial converts unless you cancel. No implementation fee. Prefer no card? Sign up for Free.